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REMARKS 

The Examiner has rejected Claims 1-66 under 35 U.S.C. 103(a) as being 
unpatentable over "Symantec System Center Implementation Guide" (hereinafter 
"Symantec") in view of Chen (U.S. Patent 5,960,170) in view of Brown ("Data 
Communications") and further in view of Graham ("URLs for HTTP Servers"). 
Applicant respectfully disagrees with such rejection, especially in view of the 
amendments made hereinabove to each of the independent claims. 

With respect to each of the independent claims, the Examiner has relied on 
section 8.1.1 in Graham to make a prior art showing of applicant's claimed technique 
therein said data retrieving logic and said report sending logic use an internet URL to 
specify said requested data to said receiving computer, said internet URL also containing 
said report data to be sent to said receiving computer" (see this or similar, but not 
necessarily identical language in each of the independent claims). 

Applicant respectfully asserts that such excerpt only teaches a URL that includes 
(1) the directory to a program/script and (2) the search parameters for the program/script 
to utilize when performing a search. Applicant emphasizes the URL example shown in 
section 8.1.1 as follows: 

http://some.site.edu/cgi-bin/foo?argl+arg2+arg3 

As shown in Graham, such URL only contains the directory (i.e. http://some.site.edu/cgi- 
bin/foo-) and the parameters (i.e. argl+arg2+arg3). Applicant, on the other hand, claims 
that the "internet URL also contain[s] said report data to be sent to said receiving 
computer" (emphasis added). Clearly, Graham's disclosed directory and parameters do 
not meet applicant's claimed report data, especially when read in context, namely that the 
"report data identifies] said reporting computer and said event" (see each of the 
independent claims). Furthermore, Graham's disclosed directory and parameters also do 
not meet applicant's claimed "internet URL. . . [that] specifies] said requested data" 
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(emphasis added). 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re VaecK9A1 F,2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of 'the prima facie 
case of obviousness has not been met since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has included the following claim language, as highlighted below, in 
each of the independent claims to further clarify the distinction argued above; 

"wherein said data retrieving logic and said report sending logic use an 
internet URL to specify said requested data to said receiving computer, said 
internet UR L specifying said requested data also containing said report data to be 
sent to said receiving computer.* 

Thus, a notice of allowance or a proper prior art showing of all of applicant's 
claim limitations, in combination with the remaining claim elements, is respectfully 
requested. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. Just by way of example, with respect to Claim 4 et aL, the Examiner 
has relied on pages 13 and 1 8 in Symantec to make a prior art showing of applicant's 
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claimed technique "wherein said requested data is a description of said event" Applicant 
respectfully asserts that such excerpts from Symantec only teach that the Symantec 
System Center provides alerting, logging and data export and activating tasks, and that 
virus update files and product updates can be retrieved from a master primary server. 
Clearly, such teachings do not even suggest a " description of said event," as claimed 
(emphasis added)- 

With respect to Claim 5 et al., the Examiner has relied on pages 1 8 and 73 in 
Symantec to make a prior art showing of applicant's claimed technique "wherein said 
event is detection of a computer file containing a computer virus and said requested data 
is a description of said computer virus." First, applicant respectfully asserts that 
Symantec does not teach a description of a computer virus, as claimed by applicant, for 
the reasons noted above with respect to Claim 4 et al. Second, it seems the Examiner has 
attempted to show that Symantec discloses a detection of a computer virus and that 
Symantec provides a description of a computer virus without taking into account the 
context of applicant's claim language. In particular, applicant claims that "said event is 
detection of a computer file containing a computer virus and said requested data is a 
description of said computer virus" where, for example, said event is identified in a report 
and said requested data is fetched "from a receiving computer" (see each of the 
independent claims for context-emphasis added). 

With respect to Claim 6 et al., the Examiner has again relied on pages 18 and 73 
in Symantec to make a prior art showing of applicant's claimed technique "wherein said 
event is detection of a computer file containing a computer virus and said requested data 
is an updated set of computer virus detecting data for use in detecting computer viruses." 
For substantially the same reasons as argued above with respect to Claim 5 et al., 
applicant respectfully asserts that Symantec fails to teach applicant's specific claim 
language when read in context . 

With respect to Claim 8 et al, the Examiner has relied on the Figure on page 73 
of Symantec to make a prior art showing of applicant's claimed technique "wherein said 
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reporting computer collates report data specifying one or more events that is sent together 
from said reporting computer to said receiving computer during said fetch of said 
requested data." Applicant respectfully asserts that such figure only shows a list of alerts. 
Clearly, a list of alerts that each show the type of event discovered and the computer from 
which said event occurred does not meet all of applicant's claim language, namely that 
"said reporting computer collates report data specifying one or more events that is sent 
together from said reporting computer to said receiving computer du ring said fetch of 
said requested data " (emphasis added). In feet, applicant notes that the log shown on 
page 73 of Symantec is associated with a specific server and that a copy is merely 
displayed when requested by a local console, but not that collated report data "is 
sent. ..during said fetch of said requested data/' as claimed by applicant. 

Again, since at least the third element of the prima facie case of obviousness has 
not been met, a notice of allowance or a proper prior art showing of all of the claim 
limitations, in the context of the remaining elements, is respectfully requested. 

Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 67-74 below 1 which are added for full consideration: 

"wherein said report data includes: 

a MAC address identifying a network card of said reporting computer; 
a date of said event; 
a time of said event; 

an identifier of a computer program used by said reporting computer to 
detect said event; 

an identifier of a version of a computer program used by said reporting 
computer to detect said event; 

an identifier of a set of event detecting data used by a computer program 
used by said reporting computer to detect said event; 

an identifier of an event type detected by said reporting computer; 
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an action taken by said reporting computer upon detection of said event; 

and 

a checksum of a file that triggered said event" (see Claim 67); 

"wherein said internet URL includes a name of a script running on said 
receiving computer and encrypted report data" (see Claim 68); 

"wherein said script decrypts said encrypted report data" (see Claim 69); 

"wherein said report data includes an identifier of a driver triggered during 
said event" (see Claim 70); 

"wherein said identifier of said driver is mapped to an identity of a virus 
that triggered said event" (see Claim 71); 

''wherein said URL is not displayed on said reporting computer" (see 
Claim 72); 

"wherein said URL is in the form of a hypertext link that is associated 
with a description of said event" (see Claim 73); and 

"wherein selection of said hypertext link results in a URL request being 
passed to said receiving computer" (see Claim 74). 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100, The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
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Deposit Account No. 50-1351 (Order No. NAI1P459/01.021.01). 



P.O. Box 721120 

San Jose, CA 95172-1 120 

408-505-5100 
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